Privacy Impact Assessment Questionnaire
OSHA Web Services FY 2011
3.1 Overview
OSHA Web Services is a General Support System including 13 minor applications and is owned by OSHA’s Directorate of Information Technology. The purpose is to provide access to materials and interactive resources that support the OSHA mission. In addition the site provides public access to more than 3.2 million inspection records and a number of online services for the public. OWS is an OSHA Major Information System (MIS). OWS was developed in 1994 and has been operational since 1995. OWS hosts the OSHA Public Web Site, (www.osha.gov); the OSHA Intranet, (intranet.osha.gov); the OSHA Extranet, (extranet.osha.gov); the joint US / European Union web site, (www.useuosh.org); the joint Tri-National web site, (www.naalcosh.org); and several minor applications. The OSHA Public Web Site includes over 400,000 pages and more than 2 million hypertext links on enforcement, standards, training, outreach, education, alliances, and workplace hazards by industry or process. The Public Site receives more than 12 million visitor sessions monthly. OWS includes web page development services, including dynamic database driven content and database management, application development, operating system management, and server hardware management. OWS primarily displays static content to users of the web sites. However, there are a few applications that require public interaction such as ordering OSHA publications and filing a workplace complaint online. While non-sensitive personally identifiable information, (PII), is collected and maintained from the public it is not displayed. OWS modules include hardware procurement and maintenance, database administration, application administration, document creation and management, and overall security. OWS received its Authority to Operate on May 23, 2007.
3.2 Characterization of the Information
The following questions are intended to define the scope of the information requested and/or collected as well as reasons for its collection as part of the program, system, or technology being developed.
Specify whether the system collects personally identifiable information (PII) on DOL employees, other federal employees, contractors, members of the public (U.S. citizens), foreign citizens, or minor children.
Some minor applications supported by the GSS collect non-sensitive PII on DOL employees, state OSHA employees, contractors, and members of the public.
- What are the sources of the PII in the information system?
Users of OSHA Web Services voluntarily submit non-sensitive PII in order to use specific services.
- What is the PII being collected, used, disseminated, or maintained?
Typical contact information is collected, used, and maintained. Only the OSHA 800 number application displays non-sensitive DOL employee information, and only to the OSHA 800 number call center staff.
- How is the PII collected?
Web based forms.
- How will the information be checked for accuracy?
Some technical controls are in place and data is checked during submission on the form. The contact information is verified or rejected as the minor applications attempt to provide the requested services, some applications use automated means and some require human intervention.
- What specific legal authorities, arrangements, and/or agreements defined the collection of information?
The standard DOL web privacy policy is posted on the site. Users of OSHA Web Services voluntarily submit non-sensitive PII in order to use specific services.
- Privacy Impact Analysis
Risks are very low since the data is only used for contact purposes and is not displayed. While database administrators have direct access they are governed by DOL and OSHA policy regarding disclosure and separation of duties. The OSHA 800 number application displays non-sensitive DOL employee information only to the OSHA 800 number call center staff using IP restricted access to the actual call center.
3.3 Uses of the PII
The following questions are intended to clearly delineate the use of information and the accuracy of the data being used.
- Describe all the uses of the PII
The non-sensitive PII is used for contacting users of some OSHA minor applications such as mailing OSHA publications and responding to online complaints.
- What types of tools are used to analyze data and what type of data may be produced?
No analysis tools are used other that basic automated data checking during submission. No data is reused, produced in another form, or displayed.
- Will the system derive new data, or create previously unavailable data, about an individual through aggregation of the collected information?
No.
- If the system uses commercial or publicly available data, please explain why and how it is used.
OWS considers all collected PII to be commercially or publicly available and is therefore non-sensitive. Data is used only for the purpose of contacting the requesting web users.
- Privacy Impact Analysis
Risks are very low since the data is only used for contact purposes and is not displayed. While database administrators have direct access they are governed by DOL and OSHA policy regarding disclosure and separation of duties.
3.4 Retention
The following questions are intended to outline how long information will be retained after the initial collection.
- How long is information retained in the system?
Information is retained in the database and through automated emails for some applications. All information is maintained in the database for auditing purposes. There are currently no plans for deletion. Emails are retained according to DOL, OSHA, and minor application owner policy.
- Has the retention schedule been approved by the DOL agency records officer and the National Archives and Records Administration (NARA)?
No.
- How is it determined that PII is no longer required?
Ongoing life cycle operations and maintenance analysis with program offices responsible for the minor applications collecting the data.
- What efforts are being made to eliminate or reduce PII that is collected, stored or maintained by the system if it is no longer required?
PII is purged for minor applications using it, every six months and deleted permanently if the application is no longer being used.
- Privacy Impact Analysis
Possible low level risks are:
- Running out of storage space on the database server. Not an issue in the foreseeable future.
- Failure of staff to comply with DOL, OSHA, and minor application owner policy.
3.5 Internal Sharing and Disclosure
The following questions are intended to define the scope of sharing within the Department of Labor.
- With which internal organization(s) is the PII shared, what information is shared, and for what purpose?
Information is only shared with the owners of some minor applications or a gatekeeper through automated emails.
- How is the PII transmitted or disclosed?
Information in the database is not transmitted or disclosed. Automated emails are directed only to the system owners or a gatekeeper.
- Privacy Impact Analysis
Possible low level risks are:
- The emails are not encrypted and could be intercepted. However, they are sent only to specific system owners or gatekeepers that are all internal to DOL. The OSHA online complaint form is an exception and emails are sent externally to OSHA state gatekeepers. Also, PII contained in these emails is non-sensitive and publicly available.
- A database administrator, (DBA) could access the information using SQL statements. However, DBAs are governed by DOL and OSHA policy regarding disclosure and separation of duties. PII contained in these emails is non-sensitive and publicly available. Also, the standard DOL email disclaimer gets attached to the emails as they go out of the DOL email bridgehead server.
3.6 External Sharing and Disclosure
The following questions are intended to define the content, scope, and authority for information sharing external to DOL which includes federal, state and local government, and the private sector.
- With which external organization(s) is the PII shared, what information is shared, and for what purpose?
The only information shared is related to the OSHA online complaint form minor application. Complaints submitted that are in the jurisdiction of a state OSH plan are sent to the state’s gatekeeper via email.
- Is the sharing of PII outside the Department compatible with the original collection? If so, is it covered by an appropriate routine use in a SORN? If so, please describe. If not, please describe under what legal mechanism the program or system is allowed to share the PII outside of DOL.
Yes. States with their own OSH enforcementprograms are required to at least meet all Federal regulations and receive 50% funding from OSHA and states with consultation programs receive 90% federal funding from OSHA.
- How is the information shared outside the Department and what security measures safeguard its transmission?
Sent via email. Emails are sent directly to a specific state OSH gatekeeper. Also, PII contained in these emails is non-sensitive and publicly available.
- Privacy Impact Analysis
Possible low level risks are: - The emails are not encrypted and could be intercepted. However, they are sent only to specific system owners or gatekeepers that are all internal to DOL. The OSHA online complaint form is an exception and emails are sent externally to OSHA state gatekeepers. PII contained in these emails is non-sensitive and publicly available. Also, the standard DOL email disclaimer gets attached to the emails as they go out of the DOL exchange bridgehead server.
3.7 Notice
The following questions are directed at notice to the individual of the scope of PII collected, the right to consent to uses of said information, and the right to decline to provide information.
- Was notice provided to the individual prior to collection of PII?
Yes.
- Do individuals have the opportunity and/or right to decline to provide information?
Yes.
- Do individuals have the right to consent to particular uses of the information? If so, how does the individual exercise the right?
By submitting their information they automatically consent to its use according to the DOL web Privacy and Security Statement located here:
http://www.dol.gov/dol/privacynotice.htm
- Privacy Impact Analysis
- Possible low level risks are:
- The Privacy and Security Statement" link is on the bottom of all OWS pages. It’s possible that users won’t click on the link and view the policy. However, the individuals are fully aware of the information collection since they are specifically entering their information in the minor applications.
3.8 Access, Redress, and Correction
The following questions are directed at an individual’s ability to ensure the accuracy of the information collected about them.
- What are the procedures that allow individuals to gain access to their information?
Generally, they cannot access their information. Help desk support is available for some minor applications in which they would talk directly to an OWS DBA who could access their information.
- What are the procedures for correcting inaccurate or erroneous information?
If an individual enters incorrect information they will not receive the services of the minor application collecting it. They will have to reenter their information again to obtain access to those services.
- How are individuals notified of the procedures for correcting their information?
If their contact information is entered incorrectly there is no way to contact them.
- If no formal redress is provided, what alternatives are available to the individual?
They will have to reenter their information again to obtain access to those services.
- Privacy Impact Analysis
Information access and redress is not available so there is no risk. Correction is accomplished by the individual submitting correct information to access the specific service.
3.9 Technical Access and Security
The following questions are intended to describe technical safeguards and security measures.
- What procedures are in place to determine which users may access the system and are they documented?
System administrators and database administrators are required to sign Rules of Behavior and are officially appointed by the Directorate of Information Technology Director with a Letter of Appointment. This process is documented in an OWS Standard Operating Procedure.
- Will Department contractors have access to the system?
Yes, OSHA contractors have access to the GSS.
- Describe what privacy training is provided to users, either generally or specifically relevant to the program or system?
OWS staff is trained by the OWS project manager and security lead on privacy issues and requirements during the employment boarding process. Also, annual security training is required per FISMA which also contains general privacy training.
- What auditing measures and technical safeguards are in place to prevent misuse of data?
Database auditing is in use.
- Privacy Impact Analysis
Possible low level risks are:
Those possibly associated with DOL only addressing selected NIST 800-53 Revision 2 requirements this fiscal year.
3.10 Technology
The following questions are directed at critically analyzing the selection process for any technologies utilized by the system, including system hardware, RFID, biometrics, and other technology.
- What stage of development is the system in, and what project development life cycle was used?
OWS is in the Operations and Maintenance Phase according to DOL policy.
- Does the project employ technology which may raise privacy concerns? If so please discuss their implementation?
OWS utilizes DOL approved and evaluated technology. There are no known privacy concerns related to utilized technology.
3.11 Determination
As a result of performing the PIA, what choices has the agency made regarding the information technology system and collection of information?
OSHA has completed the PIA for OSHA Web Services which is currently in operation. OSHA has determined that the safeguards and controls for this moderate system adequately protect the information.
OSHA has determined that it is collecting the minimum necessary information for the proper performance of a documented agency function.
